Responsible Disclosure Notice
A careful, no-obligation way to tell a verified owner about a security observation drawn only from public information.
Letter version
TO: Recipient name / role, Organisation RE: A possible security observation regarding domain / asset REF: VF-DISC-0001 · date
- Who we are. We are Provider legal name, trading as Verfend, an independent security-testing studio based in Recife, Brazil. This letter is a courtesy, not a sales approach.
- What this is — and what it is not. From publicly observable information only — for example, public DNS records, the TLS certificate, HTTP response headers, or a public advisory — we noticed an indicator of a possible configuration issue affecting domain / asset. We have not accessed, scanned, tested, or attempted to access your systems. The indicator has not been confirmed as an exploitable vulnerability.
- We would confirm ownership first. Before sharing any detail, we need to verify that you are the legitimate owner of, or an authorised contact for, domain / asset. This protects both you and us, and ensures the information reaches the right people.
- A secure channel. Once ownership is confirmed, we can share a concise, factual description through a secure channel (secure channel / PGP key / encrypted link) and agree whether any further validation would be appropriate. Please do not send passwords, personal data, or production data in reply.
- No payment demand, no pressure. An observation is not a demand for payment. We set no deadline and apply no urgency. You are free to act with your own team, to engage anyone you choose, or to do nothing at all.
What happens next
- Verify ownership — you confirm that you are the owner of, or an authorised contact for, domain / asset.
- Secure channel — we send the concise description through the agreed secure channel.
- Your choice — you remediate with your own team; or, only if you wish, you may ask us about our Validate service (independent finding validation). Any testing would begin only after a written Service Agreement (Document 03) and Authorisation to Test (Document 04) have been signed.
Opt-out
If you would prefer no further contact, reply with "STOP" (or simply "no") and we will not write again. We do not add you to any mailing list.
Signed, Name — Verfend · email · website
E-mail version (EN)
Subject: A possible security observation regarding domain — for the verified owner
Hello,
We are Verfend, an independent security studio. From publicly observable information only (such as public DNS, the TLS certificate, and HTTP response headers), we noticed an indicator of a possible configuration issue on domain. We have not accessed, scanned, or tested your systems, and this is not confirmed as a vulnerability.
If you are the owner or an authorised contact, reply and we will verify ownership and then share a concise description through a secure channel. Please do not send passwords or production data in reply. This is not a demand for payment, and there is no deadline — you are free to use your own team.
If you would rather we did not write again, just reply "STOP".
Name — Verfend · email · website
E-mail version (PT-BR)
Assunto: Uma possível observação de segurança sobre domain — para o proprietário verificado
Olá,
Somos a Verfend, um estúdio independente de segurança. A partir apenas de informações públicas (como DNS público, o certificado TLS e os cabeçalhos HTTP), notamos um indício de uma possível falha de configuração em domain. Não acessamos, não varremos e não testamos os seus sistemas, e isto não está confirmado como uma vulnerabilidade.
Se você for o proprietário ou um contato autorizado, responda que verificamos a titularidade e, em seguida, compartilhamos uma descrição concisa por um canal seguro. Por favor, não envie senhas nem dados de produção na resposta. Isto não é cobrança e não há prazo — você é livre para usar a sua própria equipe.
Se preferir não receber novo contato, basta responder "STOP".
Name — Verfend · email · website
Verfend · Independent Security Operations · email · website · Document 11 v1.0 · date